Worm:Win32/Parite.A

Win32/Parite.A is a memory resident polymorphic file infector that targets Windows 32-bit portable executable (PE) EXE and SCR files on the local file system and on writeable network shares. During the initial infection stage, Win32/Parite.A drops a DLL to the user's Temp directory. The file name of the DLL is composed of random letters and numbers as follows:

 

[3 letters][1 digit].tmp

 

For example, the file may be named ofa1.tmp or fia1.tmp.

 

The infected file then loads this DLL and executes its code. The DLL is injected into the Explorer.exe process, allowing it to be memory resident. Win32/Parite.A then appends itself to all PE EXE and SCR files on the local drive and on writeable network shares.

 

In order to ensure the virus doesn't continually repeat the routine, during the initial infection process the virus creates a mutex named "Residented" and creates the following Registry subkey to serve as a marker:

 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\PINF